IngressNightterror (CVE-2025-1974)

Overview

This repository is my research on IngressNightmare vulnerability. It includes a vulnerable Ingress deploy files, exploit itself and shared object payload.

CVE

The list of CVE indexes:

• CVE-2025-1974 - Root vulnerability
• CVE-2025-24514 - auth-url annotation injection
• CVE-2025-1097 - auth-tls-match-cn annotation injection
• CVE-2025-1098 - image UID abuse

References

Just some refs:

• Original WIZ Research post
• Kubernetes github issue
• Kubernetes blog post
• Amazon AWS bulletin
• Google clound bulletin

Root cause

The root of this vulnerability lies in the lack of proper input sanitization. When you send an AdmissionReview request, it creates a temporary NGINX configuration that is later tested for validity using the nginx -t command. See the source code with the bug mitigated.

The ability to control the content of the configuration being tested allows us to utilize a wide range of config fields to inject malformed config:

• auth-url - goes without proper sanitization, allowing us to add a # and \n. We will use this injection point.
• auth-tls-match-cn - only requires the field to start with CN= and be a valid regexp.
• ing.UID - the UID goes into the config as-is.

The fact that the NGINX config is only tested slightly reduces the number of directives we can use. One of the directives that is left is ssl_engine, which allows us to load shared libraries. This is a nice entry point. But how can we put our .so file into the pod filesystem?

The clever folks at WIZ came up with the idea of sending a request with our .so object as the body, and if it's big enough, NGINX saves it to a file in procfs! We can also adjust the Content-Length, making NGINX wait for more data, causing it to keep the file in procfs for some time. The actual PID and FD number will be guessed.

For more information, read the original analysis article by the WIZ research team.

Exploitation

The exploit code is pretty self-explanatory. So go watch the source.

Stand Setup

1. Clone the repository:

   root@kitploit:~

   git clone https://github.com/I3r1h0n/IngressNightterror
   cd IngressNightterror
   

2. Start a docker k3s image:

   root@kitploit:~

   cd stand
   docker compose up -d
   

3. Deploy the NGINX Ingress:

   In case you're using Linux/Mac, you can deploy it using script:

   root@kitploit:~

   ./k8s/setup.sh
   

   ---

   If you on windows, or want more control over deployment process, do these by hands:

   Deploy NGINX Ingress:

   root@kitploit:~

   kubectl --kubeconfig=./output/kubeconfig.yaml apply -f ./k8s/ingress.yaml
   

   Now you can use kubectl with config providen in ./output. Don't forget to use namespace ingress-nginx.

   Important note: the ingress.yaml is made from vulnerable NGINX Ingress

Payload shared object

The payload is simple reverse proxy. Don't forget to edit the port and ip address before building it with:

make all

It will build the shared object using docker container gcc:latest.

Creds

Great respect to the WIZ Research Team who originaly discorved a vulnerability, and to NGINX Ingress mainterners.

prod by I3r1h0n.